Subprocessors
Version 1.0 · Effective from 5 October 2026
Current list
The providers below process data on our behalf (as processors or subprocessors within the meaning of the Data Processing Agreement), with the exception of Stripe, which is an independent controller of payment data.
- Provider
- Supabase, Inc.
- Purpose
- database, authentication, file storage
- Data
- all Service data
- Location and transfer basis
- EU (Frankfurt, Germany); access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses
- Provider
- Vercel Inc.
- Purpose
- application and serverless hosting, technical logs
- Data
- request data, IP address, logs
- Location and transfer basis
- EU (Frankfurt, Germany) and global edge network; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses
- Provider
- OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.)
- Purpose
- AI counterpart in chat, Reports, hints, scenario builder, transcription of uploaded recordings
- Data
- conversation and material content, transcripts (no email address or name unless you type them into the conversation)
- Location and transfer basis
- US and EU; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses. API data is not used for model training, response storage disabled, up to 30 days for abuse monitoring
- Provider
- Eleven Labs Inc.
- Purpose
- voice conversations: speech recognition, AI counterpart voice
- Data
- real-time voice (not recorded), transcript, scenario instructions
- Location and transfer basis
- US; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses. Conversation record at the provider deleted after 30 days
- Provider
- Plus Five Five, Inc. (Resend)
- Purpose
- email delivery (sign-in link, account notifications)
- Data
- email address, system message content
- Location and transfer basis
- US; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses
- Provider
- nazwa.pl sp. z o.o.
- Purpose
- mailbox for contact and complaints
- Data
- correspondence sent to us
- Location and transfer basis
- Poland; no transfer outside the EEA
- Provider
- Stripe Payments Europe, Limited (independent controller)
- Purpose
- payment processing, invoices, customer portal
- Data
- email address, billing and invoice details, payment data
- Location and transfer basis
- Ireland (EU), with access by the Stripe group from the US; Stripe is an independent controller for payment data; transfers under the Stripe privacy policy
| Provider | Purpose | Data | Location and transfer basis |
|---|---|---|---|
| Supabase, Inc. | database, authentication, file storage | all Service data | EU (Frankfurt, Germany); access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses |
| Vercel Inc. | application and serverless hosting, technical logs | request data, IP address, logs | EU (Frankfurt, Germany) and global edge network; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | AI counterpart in chat, Reports, hints, scenario builder, transcription of uploaded recordings | conversation and material content, transcripts (no email address or name unless you type them into the conversation) | US and EU; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses. API data is not used for model training, response storage disabled, up to 30 days for abuse monitoring |
| Eleven Labs Inc. | voice conversations: speech recognition, AI counterpart voice | real-time voice (not recorded), transcript, scenario instructions | US; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses. Conversation record at the provider deleted after 30 days |
| Plus Five Five, Inc. (Resend) | email delivery (sign-in link, account notifications) | email address, system message content | US; access from the US possible: EU-US Data Privacy Framework (where certified) or standard contractual clauses |
| nazwa.pl sp. z o.o. | mailbox for contact and complaints | correspondence sent to us | Poland; no transfer outside the EEA |
| Stripe Payments Europe, Limited (independent controller) | payment processing, invoices, customer portal | email address, billing and invoice details, payment data | Ireland (EU), with access by the Stripe group from the US; Stripe is an independent controller for payment data; transfers under the Stripe privacy policy |
Changes to the list
We notify customers with a data processing agreement by email at least 14 days in advance of the addition or replacement of a provider. During that time, objections may be sent to hej@wojs.app. The date of the last change to the list is shown at the top of the page.